Plan DPDP Act 2023 and DPDP Rules 2025 compliance: timelines, consent, data principal rights, Significant Data Fiduciary obligations, breach response and penalties.
The Digital Personal Data Protection Act, 2023 (DPDP Act) has turned data protection from a best practice into a legal requirement for every organization that processes digital personal data of individuals in India — including many companies based outside India.
With the DPDP Rules 2025 notified in November 2025, obligations are now concrete: itemized notices, free and specific consent, purpose-based retention, breach reporting within 72 hours and new duties for Significant Data Fiduciaries. This hub is built for teams that need to understand the law and then turn it into operating controls.
Use this hub when your product or enterprise processes personal data of individuals in India — whether you operate in India, or serve Indian customers from the US, the Gulf, Europe, Asia or Australia. The Act applies extraterritorially to processing connected with offering goods or services to people in India.
The mistake many teams make is treating DPDP compliance as a document exercise after the product is designed. Consent flows, privacy notices, retention windows, breach response and governance obligations shape product design, user journeys, data architecture and procurement.
A practical compliance roadmap should connect legal interpretation with operational design. The goal is to know what is in scope, which controls are required, who owns them, how evidence is collected and how the program changes as rules evolve.
Map scope: what personal data you process, for whom, and whether Indian residents are in scope.
Design notices, consent and data principal rights workflows into user journeys.
Define retention, security safeguards, breach response and evidence ownership.
Review controls before May 2027 full enforcement and whenever scope changes.
Use these questions in internal planning before selecting tools, budgeting a project or booking a deeper advisory session.
Start with the service path, then use the guide to build a complete compliance plan.
A useful hub should help a visitor make a decision, not just collect links. For this topic, a strong next step produces these concrete outputs.
The Digital Personal Data Protection Act, 2023 is India's national data protection law. It governs how organizations process digital personal data, grants individuals rights over their data and establishes the Data Protection Board of India to enforce penalties.
The Rules were notified in November 2025 with an 18-month phased rollout: Board provisions from November 2025, Consent Managers and cross-border mechanisms from November 2026, and full Data Fiduciary enforcement from May 2027.
Yes. The Act applies to processing of digital personal data outside India when it is connected with offering goods or services to individuals within India — a key consideration for international companies serving Indian customers.
Penalties are financial, up to ₹250 crore for failure to take reasonable security safeguards leading to a breach and up to ₹200 crore for breach-notification failures or violations of children's data obligations. There are no criminal penalties under the Act.
Use the hub as a starting point, then map the consent flows, controls, workflows, training and delivery plan for your organization.
Book a Discovery Call